java - KMS使用Boto3加密文件数据

Question

我使用下面的代码来 KMS 加密文件中的数据。有没有办法在 python 中使用 boto3 做类似的事情？

public KmsMasterKeyProvider getkmsKeyProvider(String arn) throws IOException{
    KmsMasterKeyProvider prov =  new KmsMasterKeyProvider(
            new DefaultAWSCredentialsProviderChain(),
            Region.getRegion(getRegion()),
            createConfiguration(),
            arn);
    return prov;

}

加密代码

        AwsCrypto crypto = new AwsCrypto();
        KmsMasterKeyProvider prov =  util.getkmsKeyProvider(keyArn);

            FileInputStream decryptedStream = new FileInputStream(temp_data_file);
        String output = prop.getProperty(OUTPUT_TMP_PATH)+"file.out";

        final FileOutputStream out = new FileOutputStream(output);
        final CryptoOutputStream<?> encryptingStream = crypto.createEncryptingStream(prov,out);
        IOUtils.copy(decryptedStream, encryptingStream);
        encryptingStream.close();
        decryptedStream.close();

        File outputFile = new File(output);

Answer 1

您显示的代码示例使用的是 AWS 加密 SDK[1]，它可用于 Python[2]，是的!

与您在问题中显示的内容等效的代码片段是:

import aws_encryption_sdk

def encrypt_file(cmk_arn, plaintext_filename, ciphertext_filename):
    key_provider = aws_encryption_sdk.KMSMasterKeyProvider(key_ids=[cmk_arn])

    with open(plaintext_filename, "rb") as plaintext, open(ciphertext_filename, "wb") as ciphertext:
        with aws_encryption_sdk.stream(mode="encrypt", source=plaintext, key_provider=key_provider) as encryptor:
            for chunk in encryptor:
                ciphertext.write(chunk)

您可以在此处[3]以及我们的文档[1][2]中找到更多示例。

[1] https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html

[2] https://aws-encryption-sdk-python.readthedocs.io/en/latest/

[3] https://github.com/aws/aws-encryption-sdk-python/tree/master/examples/src